Deny an agent's token request

token_requests.deny.post

POST/api/v1/token-requests/{request_id}/deny

Route

Denies the request; the agent's next poll answers denied. Needs a session.

Parameters#

Deny an agent's token request: parameters
Field	Description
`request_id`pathstringrequired	The request's ID, tkr_….

Response#

200 Denied.

Deny an agent's token request: response fields
Field	Description
`id`stringrequired	The request's ID, tkr_….
`name`stringrequired	What the agent calls itself. The agent wrote this; it isn't checked.
`description`stringrequired	What the agent says it wants the token for. The agent wrote this too.
`requested_access`one of: read_only, read_writerequired	The access the agent asked for.
`status`one of: pending, approved, denied, claimed, expiredrequired	pending waits for a person; approved waits for the agent to collect its token; claimed means it has; denied and expired are final.
`origin`string or nullrequired	Roughly where it was asked from, such as "Brooklyn, US". Null if unknown.
`created_at`string (date-time)required	When the agent asked, UTC.
`expires_at`string (date-time)required	When it stops being approvable or collectable, UTC.
`household_name`string or nullrequired	The household it was approved for, once approved.
`access`one of: read_only, read_write, null or nullrequired	The access granted, once approved.

Errors#

Every error has the same envelope: error.code, error.message, error.details, error.recovery and error.request_id.

Deny an agent's token request: errors
Status	Code	When
`401`	`unauthenticated`	The request has no valid session.
`403`	Read error.code	Described above.
`404`	`not_found`	The household doesn't exist, or you aren't a member of it.
`409`	Read error.code	Described above.

Examples#

No call has been recorded for this operation yet, so this example is built from its schema. The values are placeholders.

Built from the schema

Not recorded from a real call: the fields are filled in from the schema, so the values are placeholders.

Request, curl

curl -X POST 'https://rigel.house/api/v1/token-requests/req_01K9BKNGK0ENW3AHRZ6DMV29GQ/deny' \
  -H "Cookie: rigel_session=$RIGEL_SESSION"

Request, TypeScript

const response = await fetch("https://rigel.house/api/v1/token-requests/req_01K9BKNGK0ENW3AHRZ6DMV29GQ/deny", {
  method: "POST",
  headers: {
    Cookie: `rigel_session=${process.env.RIGEL_SESSION}`,
  },
});
const data = await response.json();

Request, HTTP

POST /api/v1/token-requests/req_01K9BKNGK0ENW3AHRZ6DMV29GQ/deny HTTP/1.1
Host: rigel.house
Cookie: rigel_session=<your session>

Response, 200

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: req_01K9BKNGK0ENW3AHRZ6DMV29GQ

{
  "id": "example",
  "name": "Example",
  "description": "example",
  "requested_access": "read_only",
  "status": "pending",
  "origin": "Brooklyn, US",
  "created_at": "2026-11-06T18:00:00Z",
  "expires_at": "2026-11-06T18:00:00Z",
  "household_name": "example",
  "access": "read_only"
}